08-21-2024 04:38 PM
Network Segmentation of audio-video environment. I am looking Network Segmentation of our one Subnet of AV. Can anyone help me on this? If you have best example or step by step process to do it Cisco switch or will need firewall or any other third-party product like color tokens or Lumio or Cisco ISE
Solved! Go to Solution.
08-22-2024 10:01 AM
@ddesai you could use a dedicated VLAN for your AV devices, then assign a ACL on the SVI's on the switch to control the traffic routed between different VLANs. You could also use a VLAN (VACL) which would restrict communication within the VLAN, example.
Or more modern solution would be to use ISE with TrustSec for full centralised segmentation, but that will cost a lot more money.
08-21-2024 05:28 PM
If you want to do it without any investment then split the 1 subnet into 2 or add a net new subnet, map each subnet to a new vlan and assign endpoint into the respective vlan, vlan gateway would most likely be a router or an SVI on the switch itself, if you don't want the 2 subnets to talk to each other then just add an ACL on the SVI interface. This is simplest way for a small single subnet.
you can watch this or search more similar videos
if you want to get creative you can use ISE and Cisco TrustSec and segment based on SGTs if you want to know more, provide more information about network, preferably with a topology diagram.
08-22-2024 09:32 AM
Thank you for the update, Appreciated your inputs. what is meaning to split 1 subnet into 2, Currently we are using one subnet, and we have installed few locations AV devices and configured on VLAN 50. What is example of ACL on SVI interface? Now I am good with single subnet. I have to start with core switch SVI interface correct me if I am wrong. I am doing first time so make sure everything.
08-22-2024 09:38 AM
Do we need Multilayer switch, or can we do it on cisco 9300 access layer switch?
08-22-2024 09:48 AM
I am watching video which you are sending me that was inter vlan routing not network segmentation. Correct me if I am wrong.
08-22-2024 10:01 AM
@ddesai you could use a dedicated VLAN for your AV devices, then assign a ACL on the SVI's on the switch to control the traffic routed between different VLANs. You could also use a VLAN (VACL) which would restrict communication within the VLAN, example.
Or more modern solution would be to use ISE with TrustSec for full centralised segmentation, but that will cost a lot more money.
08-22-2024 10:37 AM
As per my setup looks like I have to applied ACL on SVI because all AV devices installed on one VLAN. Correct me if I am wrong and if you have any video for one subnet with ACL than please share that will be great help to understand.
08-22-2024 10:45 AM
08-23-2024 09:14 AM
Any inputs on this ?
08-22-2024 09:51 AM
if its SVI then no need router correct ?
08-22-2024 11:02 AM
@ddesai if the switch has a SVI then it is doing the routing, you no you don't need a phyiscal router.
08-22-2024 11:01 AM
any inputs on this ?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide